{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:WGYQA3GOZREBT2OP2DPH7WFT4L","short_pith_number":"pith:WGYQA3GO","canonical_record":{"source":{"id":"2502.15270","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-21T07:52:46Z","cross_cats_sorted":[],"title_canon_sha256":"8d592d0fbd115625e70187f76d91eaa65089bd0fbdb127a13a678ba43dcf838b","abstract_canon_sha256":"8f88dd2ed44c085de5bc7dcc0145a2b7e093c30962d702026f3039b334d0a97a"},"schema_version":"1.0"},"canonical_sha256":"b1b1006ccecc4819e9cfd0de7fd8b3e2cc0f1a0ba890ab283229da6b0362c6fc","source":{"kind":"arxiv","id":"2502.15270","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.15270","created_at":"2026-07-05T10:17:58Z"},{"alias_kind":"arxiv_version","alias_value":"2502.15270v1","created_at":"2026-07-05T10:17:58Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.15270","created_at":"2026-07-05T10:17:58Z"},{"alias_kind":"pith_short_12","alias_value":"WGYQA3GOZREB","created_at":"2026-07-05T10:17:58Z"},{"alias_kind":"pith_short_16","alias_value":"WGYQA3GOZREBT2OP","created_at":"2026-07-05T10:17:58Z"},{"alias_kind":"pith_short_8","alias_value":"WGYQA3GO","created_at":"2026-07-05T10:17:58Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:WGYQA3GOZREBT2OP2DPH7WFT4L","target":"record","payload":{"canonical_record":{"source":{"id":"2502.15270","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-21T07:52:46Z","cross_cats_sorted":[],"title_canon_sha256":"8d592d0fbd115625e70187f76d91eaa65089bd0fbdb127a13a678ba43dcf838b","abstract_canon_sha256":"8f88dd2ed44c085de5bc7dcc0145a2b7e093c30962d702026f3039b334d0a97a"},"schema_version":"1.0"},"canonical_sha256":"b1b1006ccecc4819e9cfd0de7fd8b3e2cc0f1a0ba890ab283229da6b0362c6fc","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:17:58.912759Z","signature_b64":"QsCnC+E7lUMiUeZY1PnUkICjios2EeJ5YsrIrkXp+8Bzi/GylN8PFTLIVmEB7aC/FQCtms6ek5+gmqmL/pwOBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"b1b1006ccecc4819e9cfd0de7fd8b3e2cc0f1a0ba890ab283229da6b0362c6fc","last_reissued_at":"2026-07-05T10:17:58.912216Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:17:58.912216Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2502.15270","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:17:58Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Bx3e3cZTkSv8nQluN/jRrincsJ5ISBjBOSVGwhEOdO1uDKKoh13RN8RXgxKNV1GUyYRvYQ4VZT9rhew11JIsDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T02:05:27.522398Z"},"content_sha256":"c48ae47669a245107518a845d3f9708ec929120e3dde3396220d0a2deffcab33","schema_version":"1.0","event_id":"sha256:c48ae47669a245107518a845d3f9708ec929120e3dde3396220d0a2deffcab33"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:WGYQA3GOZREBT2OP2DPH7WFT4L","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"On the (In)Security of Non-resettable Device Identifiers in Custom Android Systems","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Guoai Xu, Haoyu Wang, Liu Wang, Zikan Dong","submitted_at":"2025-02-21T07:52:46Z","abstract_excerpt":"User tracking is critical in the mobile ecosystem, which relies on device identifiers to build clear user profiles. In earlier ages, Android allowed easy access to non-resettable device identifiers like device serial numbers and IMEI by third-party apps for user tracking. As privacy concerns grew, Google has tightened restrictions on these identifiers in native Android. Despite this, stakeholders in custom Android systems seek consistent and stable user tracking capabilities across different system and device models, and they have introduced covert channels (e.g., system properties and setting"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.15270","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2502.15270/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:17:58Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"4AkEJZekrIVpNLwa4HwC4pGLD9XQlXjrr4tF55k0p919twjzBY68mZyFZDWdpUgxT9vHMcKuSnvMteXb3739Cg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T02:05:27.522909Z"},"content_sha256":"66f7019b3a9406b080c464224893d945f216310a0db9c73055c31a1763675e5d","schema_version":"1.0","event_id":"sha256:66f7019b3a9406b080c464224893d945f216310a0db9c73055c31a1763675e5d"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/WGYQA3GOZREBT2OP2DPH7WFT4L/bundle.json","state_url":"https://pith.science/pith/WGYQA3GOZREBT2OP2DPH7WFT4L/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/WGYQA3GOZREBT2OP2DPH7WFT4L/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-10T02:05:27Z","links":{"resolver":"https://pith.science/pith/WGYQA3GOZREBT2OP2DPH7WFT4L","bundle":"https://pith.science/pith/WGYQA3GOZREBT2OP2DPH7WFT4L/bundle.json","state":"https://pith.science/pith/WGYQA3GOZREBT2OP2DPH7WFT4L/state.json","well_known_bundle":"https://pith.science/.well-known/pith/WGYQA3GOZREBT2OP2DPH7WFT4L/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:WGYQA3GOZREBT2OP2DPH7WFT4L","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"8f88dd2ed44c085de5bc7dcc0145a2b7e093c30962d702026f3039b334d0a97a","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-21T07:52:46Z","title_canon_sha256":"8d592d0fbd115625e70187f76d91eaa65089bd0fbdb127a13a678ba43dcf838b"},"schema_version":"1.0","source":{"id":"2502.15270","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.15270","created_at":"2026-07-05T10:17:58Z"},{"alias_kind":"arxiv_version","alias_value":"2502.15270v1","created_at":"2026-07-05T10:17:58Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.15270","created_at":"2026-07-05T10:17:58Z"},{"alias_kind":"pith_short_12","alias_value":"WGYQA3GOZREB","created_at":"2026-07-05T10:17:58Z"},{"alias_kind":"pith_short_16","alias_value":"WGYQA3GOZREBT2OP","created_at":"2026-07-05T10:17:58Z"},{"alias_kind":"pith_short_8","alias_value":"WGYQA3GO","created_at":"2026-07-05T10:17:58Z"}],"graph_snapshots":[{"event_id":"sha256:66f7019b3a9406b080c464224893d945f216310a0db9c73055c31a1763675e5d","target":"graph","created_at":"2026-07-05T10:17:58Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2502.15270/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"User tracking is critical in the mobile ecosystem, which relies on device identifiers to build clear user profiles. In earlier ages, Android allowed easy access to non-resettable device identifiers like device serial numbers and IMEI by third-party apps for user tracking. As privacy concerns grew, Google has tightened restrictions on these identifiers in native Android. Despite this, stakeholders in custom Android systems seek consistent and stable user tracking capabilities across different system and device models, and they have introduced covert channels (e.g., system properties and setting","authors_text":"Guoai Xu, Haoyu Wang, Liu Wang, Zikan Dong","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-21T07:52:46Z","title":"On the (In)Security of Non-resettable Device Identifiers in Custom Android Systems"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.15270","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:c48ae47669a245107518a845d3f9708ec929120e3dde3396220d0a2deffcab33","target":"record","created_at":"2026-07-05T10:17:58Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"8f88dd2ed44c085de5bc7dcc0145a2b7e093c30962d702026f3039b334d0a97a","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-21T07:52:46Z","title_canon_sha256":"8d592d0fbd115625e70187f76d91eaa65089bd0fbdb127a13a678ba43dcf838b"},"schema_version":"1.0","source":{"id":"2502.15270","kind":"arxiv","version":1}},"canonical_sha256":"b1b1006ccecc4819e9cfd0de7fd8b3e2cc0f1a0ba890ab283229da6b0362c6fc","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"b1b1006ccecc4819e9cfd0de7fd8b3e2cc0f1a0ba890ab283229da6b0362c6fc","first_computed_at":"2026-07-05T10:17:58.912216Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:17:58.912216Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"QsCnC+E7lUMiUeZY1PnUkICjios2EeJ5YsrIrkXp+8Bzi/GylN8PFTLIVmEB7aC/FQCtms6ek5+gmqmL/pwOBA==","signature_status":"signed_v1","signed_at":"2026-07-05T10:17:58.912759Z","signed_message":"canonical_sha256_bytes"},"source_id":"2502.15270","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:c48ae47669a245107518a845d3f9708ec929120e3dde3396220d0a2deffcab33","sha256:66f7019b3a9406b080c464224893d945f216310a0db9c73055c31a1763675e5d"],"state_sha256":"f3b16c1b206a959fdfa67e51cdd4a8116482bacef23567b95a59e004c321e9e8"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jMCFZEbw0M9J0zGUu9+dF0o9yz8cluq+Q0EWNb83aGRK8c60zHkdCRZPoQ2tf2WbiEIDSpmVdW4xNGCHIx8YBA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-10T02:05:27.528603Z","bundle_sha256":"94a42277e3bd372d5bfff938276759aa63bb511c7fe445bb5bebc027340fb727"}}